Repository navigation
fix: update dependencies to resolve security advisories - #2
Merged
Merged
Conversation
Что: - Перенесены правки из Dokploy#5517 и комментария к нему на bun: nodemailer 10.0.13, toml 5, adm-zip 0.6.1, faker 10, ws 8.22, yaml 2.9, dompurify 3.4.16, esbuild 0.28.2, hono 4.13, postcss 8.5.28, js-yaml 4.3.2 и overrides для axios, proxy-addr, source-map-js, qs, @grpc/grpc-js, @xmldom/xmldom, http-cache-semantics. - Остальные зависимости обновлены до последней версии в своей мажорной ветке, bun.lock пересобран с нуля с карантином 3 дня на свежие релизы (minimumReleaseAge). - @trpc/server выровнен до 11.19.0 во всех пакетах, dockerode 5.0.1 (это 4.0.12 без uuid), undici в apps/dokploy на 8.x как в packages/server. - Удалены неиспользуемые tailwindcss 3 и postcss из packages/server, @types/adm-zip и @types/nodemailer (типы теперь в самих пакетах). - Код под новые версии: faker.internet.username() для faker 10, тип value в labelFormatter для recharts 3.10, одна строка форматирования для Biome 2.5.15. Зачем: - bun audit: было 164 уязвимости (1 critical, 75 high, 76 moderate, 12 low), осталось 2 high без обновления внутри версии (@better-auth/scim, braces). - Одна версия tRPC во всех пакетах: раньше в проде из корня node_modules загружался @trpc/server 11.10.0, а приложение собиралось с 11.18. Риски: - Намеренно оставлены: better-auth 1.6.23 (1.7 требует миграций БД и смены ACS URL для SSO), stripe 17.2.1 (17.3+ меняет apiVersion), @stepperize/react 4.0.1 (4.2 убрал current.index), @dokploy/trpc-openapi 0.0.18 (0.0.19 меняет REST-пути), ssh2 1.16.0. - Из lockfile ушли неиспользуемые optional peers better-auth (prisma, mongodb, mysql2, pg, better-sqlite3); в коде они не импортируются. - toml 5 выдает ошибку на целые числа вне безопасного диапазона JS вместо молчаливого округления. Проверки: - Команды и результаты: bun audit (2 high); bun run typecheck (осталась только прежняя ошибка outputFileTracing в next.config.mjs); vitest --config __test__/vitest.config.ts (2017 passed, 4 failed в application.real.test.ts: нужен Docker Swarm, до обновления было 2016 passed / 5 failed); bun run server:build && bun run build (ok); bun run format-and-lint (0 ошибок); bun install --frozen-lockfile и bun install --production --frozen-lockfile --linker hoisted во временной копии (ok, один экземпляр ssh2 1.16.0, cpu-features, node-pty, bcrypt); dist/server.mjs на временном Postgres 16: migration.mjs ok, /api/trpc/settings.health 200, регистрация, вход и авторизованные tRPC-запросы 200; apps/schedules и apps/api на временных Postgres и Redis: /health 200. - Ограничения: Docker-образ локально не собирался (проверит Bun Migration Docker Check в PR); реальные deploy-тесты не прогнаны до конца без Docker Swarm. What: - Ported the changes from Dokploy#5517 and its review comment to bun: nodemailer 10.0.13, toml 5, adm-zip 0.6.1, faker 10, ws 8.22, yaml 2.9, dompurify 3.4.16, esbuild 0.28.2, hono 4.13, postcss 8.5.28, js-yaml 4.3.2, plus overrides for axios, proxy-addr, source-map-js, qs, @grpc/grpc-js, @xmldom/xmldom and http-cache-semantics. - Updated every other dependency to the latest release in its current major and regenerated bun.lock from scratch with a 3-day minimumReleaseAge cooldown. - Aligned @trpc/server to 11.19.0 across workspaces, moved to dockerode 5.0.1 (4.0.12 without uuid) and put apps/dokploy on undici 8.x like packages/server. - Removed the unused tailwindcss 3 and postcss from packages/server, plus @types/adm-zip and @types/nodemailer now that both packages ship their own types. - Code adjustments for the new versions: faker.internet.username() for faker 10, the labelFormatter value type for recharts 3.10, and one line of Biome 2.5.15 formatting. Why: - bun audit went from 164 advisories (1 critical, 75 high, 76 moderate, 12 low) to 2 high ones that have no in-range fix (@better-auth/scim, braces). - A single tRPC version everywhere: production previously loaded @trpc/server 11.10.0 from the root node_modules while the app was built against 11.18. Risks: - Deliberately held back: better-auth 1.6.23 (1.7 needs DB migrations and a new SSO ACS URL), stripe 17.2.1 (17.3+ changes apiVersion), @stepperize/react 4.0.1 (4.2 removed current.index), @dokploy/trpc-openapi 0.0.18 (0.0.19 changes REST paths), ssh2 1.16.0. - The fresh lockfile drops unused better-auth optional peers (prisma, mongodb, mysql2, pg, better-sqlite3); nothing in the code imports them. - toml 5 rejects integers outside the JS safe range instead of silently rounding them. Checks: - Commands and results: bun audit (2 high); bun run typecheck (only the existing outputFileTracing error in next.config.mjs remains); vitest --config __test__/vitest.config.ts (2017 passed, 4 failed in application.real.test.ts because Docker Swarm is required; before the update it was 2016 passed / 5 failed); bun run server:build && bun run build (ok); bun run format-and-lint (0 errors); bun install --frozen-lockfile and bun install --production --frozen-lockfile --linker hoisted in a temp copy (ok, single copies of ssh2 1.16.0, cpu-features, node-pty, bcrypt); dist/server.mjs on a temporary Postgres 16: migration.mjs ok, /api/trpc/settings.health 200, sign-up, sign-in and authenticated tRPC calls 200; apps/schedules and apps/api on temporary Postgres and Redis: /health 200. - Limitations: the Docker image was not built locally (the Bun Migration Docker Check workflow covers it on the PR); the real deploy tests could not finish without Docker Swarm. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Что: - В плагин scim() добавлен canGenerateToken: токен выдается только с organizationId и только участнику этой организации с нужной ролью. Зачем: - GHSA-j8v8-g9cx-5qf4 (high): в @better-auth/scim 1.6.x персональные SCIM-провайдеры без организации не привязаны к владельцу, и любой вошедший пользователь может перевыпустить чужой токен. Исправление есть только в 1.7, а она требует миграций БД. Dokploy сам выдает только токены на организацию, поэтому персональные токены можно просто запретить, как предлагает workaround из advisory. Риски: - Прямые вызовы /api/auth/scim/generate-token без organizationId теперь получают 403. - Уже существующие персональные провайдеры не удаляются; проверить можно запросом SELECT provider_id FROM scim_provider WHERE organization_id IS NULL. - bun audit продолжит показывать advisory, пока better-auth не обновлен до 1.7. Проверки: - Команды и результаты: bun run typecheck (@dokploy/server ok); сборка и запуск dist/server.mjs на временном Postgres 16 с тестовым пользователем: POST /api/auth/scim/generate-token без organizationId -> 403 "You are not allowed to generate a SCIM token", без записи в scim_provider; с organizationId владельца -> 201 и запись с organization_id. - Ограничения: отдельный Vitest-тест не добавлен, в __test__ нет тестов для SCIM-плагина. What: - Added canGenerateToken to the scim() plugin: a token is issued only with an organizationId and only to a member of that organization with the required role. Why: - GHSA-j8v8-g9cx-5qf4 (high): in @better-auth/scim 1.6.x, personal SCIM providers without an organization are not bound to an owner, so any signed-in user can regenerate someone else's token. The fix only exists in 1.7, which needs DB migrations. Dokploy itself only issues organization-scoped tokens, so personal tokens can simply be denied, as the advisory's workaround suggests. Risks: - Direct calls to /api/auth/scim/generate-token without an organizationId now get 403. - Existing personal providers are not removed; they can be found with SELECT provider_id FROM scim_provider WHERE organization_id IS NULL. - bun audit keeps reporting the advisory until better-auth is updated to 1.7. Checks: - Commands and results: bun run typecheck (@dokploy/server ok); built and ran dist/server.mjs on a temporary Postgres 16 with a test user: POST /api/auth/scim/generate-token without organizationId -> 403 "You are not allowed to generate a SCIM token" and no scim_provider row; with the owner's organizationId -> 201 and an organization-scoped row. - Limitations: no dedicated Vitest test was added; __test__ has no tests for the SCIM plugin. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Что: - github.com/gofiber/fiber/v2 в apps/monitoring обновлен с v2.52.11 до v2.52.15 (последняя v2, go 1.20 в go.mod не изменился). Зачем: - v2.52.11 затронута GHSA-mrq8-rjmw-wpq3 (DoS через переполнение параметров маршрута), GHSA-qjv7-627w-8qjv (XSS в AutoFormat) и GHSA-gcfq-8gqf-4876 (подмена X-Real-IP); Dokploy#5517 поднимает до v2.52.14, здесь взята более новая v2.52.15. Риски: - Не выявлены: patch-обновление внутри v2, остальные зависимости модуля не менялись. Проверки: - Команды и результаты: go get github.com/gofiber/fiber/v2@v2.52.15 && go mod tidy (меняются только строки fiber); go build ./... (ok); go vet ./... (ok); go test ./... (ok). - Ограничения: образ Dockerfile.monitoring (golang:1.21) локально не собирался. What: - Updated github.com/gofiber/fiber/v2 in apps/monitoring from v2.52.11 to v2.52.15 (latest v2; the go 1.20 directive in go.mod is unchanged). Why: - v2.52.11 is affected by GHSA-mrq8-rjmw-wpq3 (DoS via route parameter overflow), GHSA-qjv7-627w-8qjv (XSS in AutoFormat) and GHSA-gcfq-8gqf-4876 (X-Real-IP spoofing); Dokploy#5517 goes to v2.52.14, this takes the newer v2.52.15. Risks: - None identified: a patch update within v2, no other module dependencies changed. Checks: - Commands and results: go get github.com/gofiber/fiber/v2@v2.52.15 && go mod tidy (only the fiber lines change); go build ./... (ok); go vet ./... (ok); go test ./... (ok). - Limitations: the Dockerfile.monitoring image (golang:1.21) was not built locally. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What is this PR about?
A dependency security update for the AgentHits fork. It builds on Dokploy#5517, the review comment there, and the audit in Dokploy#5595, with the pnpm overrides rewritten for bun.
bun auditdrops from 164 advisories (1 critical, 75 high, 76 moderate, 12 low) to 2 high, neither of which can be fixed by a bump within the current versions.Commits
fix: update dependencies to resolve security advisoriesbun.lockwas regenerated from scratch, and any release younger than 3 days was skipped (minimumReleaseAge).@trpc/serverversion (11.19.0). Before, production loaded 11.10.0 from the rootnode_moduleswhile the app was built against 11.18.username()), recharts 3.10 types, and one line reformatted by Biome 2.5.15.fix: block personal SCIM tokens on better-auth 1.6: adds acanGenerateTokencheck as a workaround for GHSA-j8v8-g9cx-5qf4. The upstream fix only exists in better-auth 1.7.fix: bump fiber to v2.52.15 in monitoring: fixes three fiber advisories (DoS, XSS, X-Real-IP spoofing).Deliberately not updated
Account.issuer), a SCIM reprovision and a new SSO ACS URLapiVersionstepper.current.index, which the AI template generator usesMajor upgrades with no security fix behind them (ai 7, stripe 23, lucide 1.x, tailwind-merge 3, date-fns 4, xterm 6 and others) are left for separate PRs.
Remaining
bun auditfindings@better-auth/scim1.6.23 (high): the second commit closes the hole. The advisory will stay in the audit until the better-auth 1.7 migration.braces3.0.3 (high): no patched release exists. It can only be triggered through watch-path patterns, which users with edit rights configure, and it runs inside Next API routes that catch the error.Checklist
AgentHits-Dev.Bun Migration Docker Checkpasses on this PR (image build and smoke).Verification
bun audit: 2 high.bun run typecheck: the only error is the existingoutputFileTracingone innext.config.mjs, introduced in 47183ab.application.real.test.ts, which needs Docker Swarm. Before the update it was 2016 passed and 5 failed; the extra test that now passes is theTRPCErrorinstanceof one, fixed by the single tRPC version.bun run server:build && bun run buildsucceeds, andbun run format-and-lintreports 0 errors.bun install --frozen-lockfileandbun install --production --frozen-lockfile --linker hoistedboth pass, with single copies of ssh2 1.16.0, cpu-features, node-pty and bcrypt.dist/migration.mjsapplies cleanly and/api/trpc/settings.healthreturns 200.apps/schedulesandapps/apiboth answer/healthwith 200.apps/monitoring:go build,go vetandgo testpass.Residual risk
packages/server/src/emailsis a dev-only react-email preview with its own pnpm lockfile. Its manifest and lockfile no longer match, and the lockfile has 5 advisories. That is left for a separate follow-up.Issues related (if applicable)
Dokploy#5517, Dokploy#5595
🤖 Generated with Claude Code